Security model · pre-1.0

Know what is trusted.

A template and its embedded Go are trusted application source. Values rendered by that source are untrusted unless the application explicitly marks them otherwise.

Sandwich Hime is not a sandbox. Someone allowed to edit a .sando file can write ordinary Go statements and should be treated like any other application-code contributor.

Contextual output

The compiler tracks the HTML parser context around each dynamic expression. In the current preview it supports:

HTML text, with markup-sensitive characters escaped.
Quoted attribute values, with attribute-sensitive characters escaped.
Recognized URL attributes, with escaping plus dangerous-scheme checks at render time.
Nested components at HTML content boundaries, where a component must leave the parser in the same context in which it began.

Unsupported or ambiguous contexts fail generation instead of falling back to unescaped output. Component insertion is not allowed inside attributes, scripts, styles, or partial tag construction.

The adversarial test suite compares supported behavior with Go's documented html/template safety baseline. That is a testing reference, not a claim that the two engines accept identical syntax or contexts.

Explicit trust is conspicuous

The runtime has opaque TrustedHTML, TrustedURL, TrustedJS, and TrustedCSS values. Only clearly named Trust* functions create them.

Those functions do not sanitize input. They record an application decision that validation has already happened. himesan check reports trusted-value use so it can receive focused review.

There is no general raw-output intrinsic. Treat every trust conversion as a security-sensitive boundary and keep it close to the validation that justifies it.

Reporting a vulnerability

Read the current security policy. There is no dedicated confidential reporting address or response-time SLA yet. Do not put undisclosed vulnerability details in a public issue; use the repository owner's published Gitea contact method to request a private channel without disclosing the issue.

This preview has not received an independent security certification. Its safety claims are limited to the documented design, tests, and supported contexts.

See the technical guide for the generated API and workflow.